{
  "id": "2023-04-30-bluefield-university-avoslocker-ransomware",
  "slug": "bluefield-university-avoslocker-ransomware-2023-04-30",
  "institution": {
    "name": "Bluefield University",
    "shortName": "Bluefield",
    "state": "VA",
    "type": "private-bachelors",
    "alertSystemName": "RamAlert",
    "enrollment": 900
  },
  "incident": {
    "date": "2023-04-30",
    "endDate": "2023-05-15",
    "type": "infrastructure-failure",
    "cleryCategory": "advisory",
    "headline": "Ransomware group hijacked the emergency-alert system to send extortion messages",
    "headlinePublic": "Ransomware group hijacked the emergency-alert system to send extortion messages",
    "summary": "Between late April and early May 2023, the [AvosLocker ransomware gang seized control of Bluefield University's RamAlert emergency-notification system](https://www.bleepingcomputer.com/news/security/avoslocker-ransomware-gang-hijacks-emergency-alert-system-to-extort-bluefield-university/) and used it to send threatening SMS and email alerts directly to the students, faculty, and staff subscribed to the system, telling them their personal data had been stolen and warning them not to trust the administration. It is widely cited as the [first publicly documented case of a ransomware crew weaponizing a campus mass-notification system as a pressure channel](https://therecord.media/bluefield-university-ransomware-avoslocker), turning the safety infrastructure itself into the extortion mechanism.",
    "resolution": "confirmed-threat",
    "outcome": "Bluefield acknowledged the attack on April 30, cancelled some final exams, and brought in the FBI and outside incident-response counsel. The university did not pay the ransom; AvosLocker subsequently published a portion of the stolen data, including a W-2 tax form for the university's president and an insurance-related document, on its dark-web site in mid-May 2023.",
    "casualties": {
      "killed": 0,
      "injured": 0
    }
  },
  "alerts": [
    {
      "sequence": 1,
      "type": "initial",
      "timestamp": "2023-04-30T19:00:00-04:00",
      "timestampApprox": "Evening of Sunday, April 30, 2023; first university notice to community",
      "channel": "email",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceUrl": "https://www.bluefield.edu/cybersecurity-update/",
      "sourceDescription": "Reconstructed from Bluefield University statements quoted by BleepingComputer and the Bluefield Daily Telegraph",
      "annotations": []
    },
    {
      "sequence": 2,
      "type": "update",
      "timestamp": "2023-05-01T08:30:00-04:00",
      "timestampApprox": "Monday morning May 1, 2023; RamAlert message sent by the attackers, not the university",
      "channel": "sms",
      "verbatimText": "Hello students of Bluefield University! We are Avos Locker Ransomware. We hacked university network to extract 1.2 TB files. We have admissions data from 2018 to 2022, personal data of students and employees. A lot of personal data of students. If university does not pay us, this information will be released. Do not allow the university to lie about the severity of the attack!",
      "isVerbatimConfirmed": true,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/avoslocker-ransomware-gang-hijacks-emergency-alert-system-to-extort-bluefield-university/",
      "sourceDescription": "BleepingComputer: screenshot of RamAlert SMS distributed via the hijacked system",
      "annotations": [
        "Original typos and grammar preserved verbatim: 'We hacked university network', 'university does not pay us', etc., these tells of non-native English are part of the document.",
        "This is the message that made the case famous. The attackers walked through Bluefield's own RamAlert console and pushed an extortion notice to every phone subscribed to campus safety alerts.",
        "Final exam communications and severe-weather alerts had to be re-routed off RamAlert for the remainder of the semester."
      ],
      "characterCount": 379
    },
    {
      "sequence": 3,
      "type": "update",
      "timestamp": "2023-05-01T16:00:00-04:00",
      "timestampApprox": "Late afternoon May 1, 2023; university response after the hijacked alert",
      "channel": "email",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceUrl": "https://therecord.media/bluefield-university-ransomware-avoslocker",
      "sourceDescription": "Reconstructed from The Record's reporting quoting Bluefield's May 1 community message",
      "annotations": []
    },
    {
      "sequence": 4,
      "type": "follow-up",
      "timestamp": "2023-05-15T15:00:00-04:00",
      "timestampApprox": "Mid-May 2023; disclosure that data has been leaked on AvosLocker leak site",
      "channel": "email",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceUrl": "https://www.bluefield.edu/cybersecurity-update/",
      "sourceDescription": "Reconstructed paraphrase from Bluefield's cybersecurity update page and Bluefield Daily Telegraph coverage",
      "annotations": []
    }
  ],
  "context": "Bluefield University is a small Baptist-affiliated college in southwest Virginia with roughly 900 students. On Sunday, April 30, 2023, the [AvosLocker ransomware group](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a) breached the campus network and seized control of RamAlert, the university's [emergency-notification platform](https://www.bleepingcomputer.com/news/security/avoslocker-ransomware-gang-hijacks-emergency-alert-system-to-extort-bluefield-university/). On Monday morning May 1, the gang used RamAlert to push SMS and email blasts to the entire student body warning that 1.2 TB of data (including admissions records from 2018 to 2022) had been stolen. [The Record](https://therecord.media/bluefield-university-ransomware-avoslocker) and [BleepingComputer](https://www.bleepingcomputer.com/news/security/avoslocker-ransomware-gang-hijacks-emergency-alert-system-to-extort-bluefield-university/) both documented the hijack as the first publicly known case of a ransomware crew abusing a campus mass-notification platform to apply pressure directly on students and parents. Final exams were rescheduled, RamAlert was taken offline, and the university issued its own counter-notice telling the community to disregard the gang's messages. Bluefield declined to pay; AvosLocker published a portion of the stolen data on its leak site in mid-May. The incident is now used in [EDUCAUSE](https://library.educause.edu/topics/cybersecurity-and-privacy/ransomware) and [REN-ISAC](https://www.ren-isac.net/) training as a warning that the emergency-alert system is itself part of the attack surface and must be on a segregated identity tier.",
  "keyFindings": [
    "Reported as the first publicly documented incident of a ransomware gang seizing a campus mass-notification system to deliver extortion messages directly to students.",
    "RamAlert credentials were apparently reachable from the compromised administrative network rather than gated behind a separate identity tier.",
    "Bluefield did not pay; AvosLocker published a portion of the stolen data (including the university president's W-2 and an insurance document) on its dark-web leak site in mid-May 2023.",
    "Final exam scheduling and severe-weather alerts had to be re-routed for the remainder of the semester because the official alert channel could not be trusted."
  ],
  "responseTimeMinutes": null,
  "sources": [
    {
      "title": "AvosLocker ransomware gang hijacks emergency alert system to extort Bluefield University (BleepingComputer)",
      "url": "https://www.bleepingcomputer.com/news/security/avoslocker-ransomware-gang-hijacks-emergency-alert-system-to-extort-bluefield-university/",
      "type": "national-media"
    },
    {
      "title": "Bluefield University hit by ransomware, attackers use emergency broadcast system (The Record)",
      "url": "https://therecord.media/bluefield-university-ransomware-avoslocker",
      "type": "national-media"
    },
    {
      "title": "Bluefield University cybersecurity update page",
      "url": "https://www.bluefield.edu/cybersecurity-update/",
      "type": "official-archive"
    },
    {
      "title": "CISA Joint Cybersecurity Advisory AA22-076A: AvosLocker Ransomware",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a",
      "type": "official-archive"
    }
  ],
  "confidence": "medium",
  "tags": [
    "cyberattack",
    "ransomware",
    "avoslocker",
    "alert-system-compromise",
    "virginia",
    "private-bachelors",
    "data-breach",
    "fbi",
    "first-of-kind",
    "infrastructure-failure"
  ],
  "dateAdded": "2026-05-14",
  "lastUpdated": "2026-07-17",
  "addedBy": "ingestion"
}